gwtr - Git Worktree Manager

A simple Git worktree manager that creates worktrees in a consistent location alongside your main repository.

Features

• Consistent Naming: Creates worktrees with the pattern {repository_name}_{worktree_name}
• Automatic Branch Creation: Creates a new branch when adding a worktree
• Simple Commands: Easy-to-remember commands for common worktree operations
• Colored Output: Clear, colored terminal output for better readability
• Git Integration: Works seamlessly with existing Git repositories
• Status Overview: View all worktrees and their states at a glance
• Batch Updates: Pull latest changes from origin/main to all worktrees
• Smart Cleanup: Automatically remove merged worktrees to keep workspace tidy
• Supply Chain Audit: Detect vulnerabilities and typosquatting across all worktrees

How It Works

When you run gwtr add feature-x in a repository named myproject, it creates a new worktree at ../myproject_feature-x. This keeps all related worktrees organized at the same directory level as your main repository.

Installation

From Crates.io

cargo install gwtr

From npm

npm install -g gwtr

From Source

git clone https://github.com/katsuhirohonda/gwtr.git
cd gwtr
cargo install --path .

Usage

# Create a new worktree
gwtr add feature-x

# List all worktrees
gwtr list

# Show status of all worktrees
gwtr status

# Pull latest changes from origin/main
gwtr pull --all           # All worktrees
gwtr pull feature-x       # Specific worktree
gwtr pull                 # Current worktree

# Remove merged worktrees
gwtr prune               # Interactive mode
gwtr prune --dry-run     # Preview what would be removed
gwtr prune --force       # Skip confirmation

# Remove a specific worktree
gwtr remove feature-x

# Audit dependencies for supply chain attacks
gwtr audit              # Current worktree (cargo audit + typosquatting check)
gwtr audit --all        # All worktrees
gwtr audit --typo-only  # Typosquatting check only (no network required)

# Generate shell completion script
gwtr completions zsh
gwtr completions bash

Shell Completions

gwtr can generate completion scripts for your shell. Supported shells: zsh, bash, fish, powershell, elvish.

zsh

# Generate the script into a directory on your $fpath
gwtr completions zsh > ~/.zsh/completions/_gwtr

# Make sure that directory is on $fpath in ~/.zshrc, then reload
autoload -U compinit && compinit

bash

# Source the generated script from ~/.bashrc
echo 'source <(gwtr completions bash)' >> ~/.bashrc

After installing, try gwtr <TAB> to see subcommands, or gwtr prune --<TAB> to see option flags.

Examples

# In a repository called "myapp"
$ gwtr add new-feature
Created worktree 'new-feature' at "../myapp_new-feature"
cd '/Users/you/dev/myapp_new-feature'

$ gwtr list
Worktrees:
  /Users/you/dev/myapp (main) [main]
  /Users/you/dev/myapp_new-feature [new-feature]

$ gwtr status
Worktrees:
  /Users/you/dev/myapp (main) [main] - clean
  /Users/you/dev/myapp_new-feature [new-feature] - 2 uncommitted changes

$ gwtr pull --all
Pulling all worktrees from origin/main...
  main [main]: Already up to date
  myapp_new-feature [new-feature]: Updated

$ gwtr prune
Found 1 merged worktree to prune:
  old-feature [old-feature] at /Users/you/dev/myapp_old-feature

Prune these worktrees? [y/N] y
Pruning old-feature... done

Pruned 1 worktree

$ gwtr remove new-feature
Removed worktree 'new-feature' at "../myapp_new-feature"

$ gwtr audit --all
====== gwtr audit --all ======

=== worktree: myapp (main) ===
  Packages: 126
  [Vulnerability Check (cargo audit)]
    No vulnerabilities found
  [Typosquatting Check]
    OK  No suspicious package names found

=== worktree: myapp_feature-x (feature-x) ===
  Packages: 130
  [Vulnerability Check (cargo audit)]
    error[vulnerability]: Vulnerable crate: openssl 0.10.55
  [Typosquatting Check]
    WARN reqest 0.11.0 - similar to "reqwest" (distance: 1)

====== Summary ======
Worktrees scanned: 2
Typosquatting warnings: 1
Vulnerability errors:   1

Supply Chain Audit

gwtr audit helps protect your Rust projects from supply chain attacks by combining two checks:

1. Vulnerability Check — wraps cargo audit to detect known CVEs in your dependencies via the RustSec Advisory Database
2. Typosquatting Detection — compares every dependency name against a list of popular crates, flagging names that are suspiciously similar (e.g. reqest vs reqwest)

The --all flag scans every worktree in one pass, making it easy to audit an entire feature branch portfolio at once.

Note: cargo audit must be installed separately (cargo install cargo-audit). If it is not found, the vulnerability check is skipped and only typosquatting detection runs.

Prerequisites

• Git 2.5.0 or later (for worktree support)
• Rust 1.80.0 or later (for building from source)

Development

This project follows Test-Driven Development (TDD) practices.

# Run tests
cargo test

# Build
cargo build

# Run with debug output
cargo run -- --help

# Format code
cargo fmt

# Run clippy
cargo clippy

Contributing

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

Please make sure to:

• Update tests as appropriate
• Follow the existing code style
• Run cargo fmt and cargo clippy before submitting

Release Process

This project uses GitHub Actions for automated releases:

• crates.io: Automatically published when a GitHub release is created
• npm: Automatically published with pre-compiled binaries for all platforms

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

• Inspired by Git's worktree feature
• Built with Rust and the excellent clap CLI framework